How do I update my security in my login script from MD5 to something more secure?
authentication, hash, password-hash, php, security
Solution
Short answer
Use `bcrypt` not `md5` or `sha1`
Longer answer
Using the `crypt()` is hard. There is a new PHP password hashing API coming in PHP version 5.5, you can read about it here:
https://gist.github.com/nikic/3707231
It uses `bcrypt` and makes the whole process very easy. Of course php 5.5 isn't ready yet, so in the meantime there is a library to provide this new API right now:
https://github.com/ircmaxell/password_compat
Edit: See this thread for a much more thorough answer on the topic:
How do you use bcrypt for hashing passwords in PHP?
Problem
I have a PHP login script with salt on the database, but in my register script I see: ``` $qry = "INSERT INTO accounts(username, firstname, lastname, password) " . VALUES('$username','$fname','$lname','" . md5($_POST['password']) . "')"; ``` and for the login: ``` $qry="SELECT * FROM accounts WHERE username='$username' AND password='" . md5($_POST['password']) . "'"; ``` Is there some code that can replace the MD5? Something more secure? I've heard of SHA1 or something.